The controllers for a cyber-physical system may be impacted by sensor measurement cyberattacks, actuator signal cyberattacks, or both types of attacks. Prior work in our group has developed a theory for handling cyberattacks on process sensors. However, sensor and actuator cyberattacks have a different character from one another. Specifically, sensor measurement attacks prevent proper inputs from being applied to the process by manipulating the measurements that the controller receives, so that the control law plays a role in the impact of a given sensor measurement cyberattack on a process. In contrast, actuator signal attacks prevent proper inputs from being applied to a process by bypassing the control law to cause the actuators to apply undesirable control actions. Despite these differences, this manuscript shows that we can extend and combine strategies for handling sensor cyberattacks from our prior work to handle attacks on actuators and to handle cases where sensor and actuator attacks occur at the same time. These strategies for cyberattack-handling and detection are based on the Lyapunov-based economic model predictive control (LEMPC) and nonlinear systems theory. We first review our prior work on sensor measurement cyberattacks, providing several new insights regarding the methods. We then discuss how those methods can be extended to handle attacks on actuator signals and then how the strategies for handling sensor and actuator attacks individually can be combined to produce a strategy that is able to guarantee safety when attacks are not detected, even if both types of attacks are occurring at once. We also demonstrate that the other combinations of the sensor and actuator attack-handling strategies cannot achieve this same effect. Subsequently, we provide a mathematical characterization of the “discoverability” of cyberattacks that enables us to consider the various strategies for cyberattack detection presented in a more general context. We conclude by presenting a reactor example that showcases the aspects of designing LEMPC.
more »
« less
A Secure Control Design for Networked Control Systems with Linear Dynamics under a Time-Delay Switch Attack
Networked control systems (NCSs) are designed to control and monitor large-scale and complex systems remotely. The communication connectivity in an NCS allows agents to quickly communicate with each other to respond to abrupt changes in the system quickly, thus reducing complexity and increasing efficiency. Despite all these advantages, NCSs are vulnerable to cyberattacks. Injecting cyberattacks, such as a time-delay switch (TDS) attack, into communication channels has the potential to make NCSs inefficient or even unstable. This paper presents a Lyapunov-based approach to detecting and estimating TDS attacks in real time. A secure control strategy is designed to mitigate the effects of TDS attacks in real time. The stability of the secure control system is investigated using the Lyapunov theory. The proposed TDS attack estimator’s performance and secure control strategy are evaluated in simulations and a hardware-in-the-loop environment.
more » « less- Award ID(s):
- 1919855
- NSF-PAR ID:
- 10481536
- Publisher / Repository:
- MDPI
- Date Published:
- Journal Name:
- Electronics
- Volume:
- 10
- Issue:
- 3
- ISSN:
- 2079-9292
- Page Range / eLocation ID:
- 322
- Format(s):
- Medium: X
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
In a centralized Networked Control System (NCS), agents share local data with the central processing unit that generates control commands for agents. The control center in an NCS receives information from the agents through a communication network and produces control commands for agents. Despite all of the advantages of an NCS, such as reduced design cost and simplicity, the integration of networked connectivity can expose the NCS to adversarial attacks, such as false data injection (FDI). In this paper, a novel control approach will be developed to mitigate the FDI attack’s effect and guarantee the control objective in a networked system of permanent magnet linear motors. To achieve this, a non-singular terminal sliding mode control will be designed using an observer to ensure the tracking objective. The extended state observer will estimate the state of the system and estimate the FDI attack in real time. The control center will produce a control signal which is robust to the FDI attack and any disturbance. A Lyapunov-based stability analysis will be used to prove the stability of the observer-based controller. A three-agent permanent magnet linear motor network is selected for the simulation to show the effectiveness of the proposed scheme.more » « less
-
Industrial Control Systems (ICS) are the brain and backbone of nation's critical infrastructure such as nuclear power, water treatment, and petrochemical plants. In order to increase interoperability, real-time availability of data, and flexibility, information/communication technologies are adopted in this domain. While these information technologies have been effective, they are integrated into operational technologies without the necessary security defense. Designing an effective, layered security defense is not possible unless security threats are identified through a structural analysis of the ICS. For that reason, this paper provides an attacker's point of view on the reconnaissance effort necessary to gather details of the system dynamics - which are required for the development of sophisticated attacks. We present a reconnaissance approach which uses the system's I/O data to infer the dynamic model of the system. In this effort, we propose a novel cyber-attack which targets the controller proportional-integral-derivative gain values in a constant setpoint control system. Our findings will help researchers design more secure control systems.more » « less
-
more » « less
Abstract This work presents a detector‐integrated two‐tier control architecture capable of identifying the presence of various types of cyber‐attacks, and ensuring closed‐loop system stability upon detection of the cyber‐attacks. Working with a general class of nonlinear systems, an upper‐tier Lyapunov‐based Model Predictive Controller (LMPC), using networked sensor measurements to improve closed‐loop performance, is coupled with lower‐tier cyber‐secure explicit feedback controllers to drive a nonlinear multivariable process to its steady state. Although the networked sensor measurements may be vulnerable to cyber‐attacks, the two‐tier control architecture ensures that the process will stay immune to destabilizing malicious cyber‐attacks. Data‐based attack detectors are developed using sensor measurements via machine‐learning methods, namely artificial neural networks (ANN), under nominal and noisy operating conditions, and applied online to a simulated reactor‐reactor‐separator process. Simulation results demonstrate the effectiveness of these detection algorithms in detecting and distinguishing between multiple classes of intelligent cyber‐attacks. Upon successful detection of cyber‐attacks, the two‐tier control architecture allows convenient reconfiguration of the control system to stabilize the process to its operating steady state.
-
This work focuses on the problem of enhancing cyberattack detection capabilities in process control systems subject to multiplicative cyberattacks. First, the relationship between closed-loop stability and attack detectability with respect to a class of residual-based detection schemes is rigorously analyzed. The results are used to identify a set of controller parameters (called "attack-sensitive" controller parameters) under which an attack can destabilize the closed-loop system. The selection of attack-sensitive controller parameters can enhance the ability to detect attacks, but can also degrade the performance of the attack-free closed-loop system. To balance this trade-off, a novel active attack detection methodology employing controller parameter switching between the nominal controller parameters (chosen on the basis of standard control design criteria) and the attack-sensitive controller parameters, is developed. The proposed methodology is applied to a chemical process example to demonstrate its ability to detect multiplicative sensor-controller communication link attacks.more » « less
- Free Publicly Accessible Full Text
-
Accepted Manuscript1.0
- Journal Article:
- https://doi.org/10.3390/electronics10030322
